Reducing the potential for fraud in existing or planned e-business systems requires identifying actual weaknesses and specifying, validating and implementing appropriate countermeasures. These countermeasures should not only deal with well-known and often exploited weaknesses but should also be effective against new, previously unknown ones. A comprehensive fraud management service uses up-to-date knowledge on systems, processes and scenarios and their weaknesses and risks and on possible countermeasures to regularly inform users on increased risks and to propose improvement for existing systems or to increase the security of planned systems during design. It is critical for this type of service to develop tools that help building and maintaining this knowledge and help exploiting this knowledge for identification of new fraud potential and for the creation of new countermeasures.
Apart from identifying fraud potential, it is also useful to identify potential for any other undesired effects, for example unintentional leak of information or general security breaches. It is also desirable to identify new useful scenarios, such as planning marketing events, games, trials or modeling use cases of a product.
Fraud happens if the fraudster successfully obtains items like money, information, goods or services owned by a victim without the victim's consent or knowledge or without the promised contractual return or compensation. More generally spoken, a fraud attempt happens if an entity such as an individual, a group, an institution, an enterprise or the like tries to unlawfully achieve an advantageous state. Fraud detection aims at detecting an attempt of fraud after or while it is happening in order to reduce or avoid any damage. Fraud prevention may be achieved based on fraud detection. Advantageously, fraud prevention may also be provided a priori by including appropriate measures when designing a “system”.
The meaning of “system” refers to the system in which fraud takes place. The kind of system which is referred to depends on the level of refinement considered, for example, in a case when considering countermeasures against fraud. “System” might even mean the real life as such, for example if methods of fraud are searched which are related to interaction of different entities provided with dedicated economic behavior. “System” may also mean any e-commerce application software environment for client and server, optionally including the machines for client and server hosting both applications, optionally including networks or storing the media involved and interfaces to any procedures which take place non-electronically, for example a hand-written signature performed at a bank. Furthermore, “system” may mean any human and technical basis in any abstraction to enable all sort of fraud, also comprising completely different and even independent applications at different locations.
There is an increasing need of fraud prevention measures, as in electronic systems fraud attacks can for a lot of reasons be more effective than non-electronic fraud attacks: information can be immediately delivered to thousands and even millions of users; fraudsters can stay anonymous more easily; attacks are more easily performed against victims who want to remain anonymous; rumors can be spread very quickly and effectively and most people are typically inexperienced users of information technology (IT) equipment without sufficient knowledge or awareness of security or related suggestive measurements or care.
At present, there is no automatic way to identify new fraud scenarios based on any known fraud also in completely different applications or in different models, and therefore no automatic way of assessing potential for fraud. A common way is intuition, mostly without a thorough analysis of existing and potential fraud attacks or systems and the elements they consist of. For given or planned systems, the potential for fraud attacks can be identified by evaluating the correctness and security of the system based on a system model and on a fraud attacker model. Such evaluations are typically performed by parties interested in the correctness and security of the system. Such evaluations provide a good measure of whether the system fulfils certain security properties within the assumed model. Partly, they can also be performed automatically. A problem of such evaluations is that vulnerabilities outside the assumed model may be overlooked, for instance since the actual behavior of the users is insufficiently modeled, i.e. what else he is doing with his machine apart from the considered banking application, for example downloading, storing and executing other software. Such influence and side channels not reflected by the model are typically ignored.